Prior to GDRP – the legislation protecting personally identifiable information and the active prevention of data exfiltration was weak and seen as a toothless tiger – the view was ‘if I do not have to tell anybody or there is no real legislation or authority policing such incidents, then what’s the worst that can happen?’ (See The Stick below) Sadly the reality is far from this – GPPR has teeth and is VERY live and dangerous.